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REMARKS/ARGUMENTS 
Claims 1-30 are pending in the application. Claims 1, 3-5, 8, and 15-30 have been 
amended. No claims have been cancelled or added. The amendments to the claims as 
indicated herein do not add any new matter to this application. 

CLAIM REJECTIONS— 35 U.S.C. § 101 
Claims 15-28 stand rejected under 35 U.S.C. § 101 as allegedly being directed to non- 
statutory subject matter. By this amendment, Claims 15-28 have been amended to recite 
"computer-readable storage medium." The Patent Office has issued over 5,000 patents that 
recite at least one claim directed towards a computer-readable storage medium. For example, 
issued U.S. Patents 7,065,755, 7,065,740, and 7,065,715 each recite at least one claim 
directed towards a computer-readable storage medium. Moreover, a computer-readable 
storage medium is clearly an article of manufacture, which is one of the four statutory 
categories of patentable subject matter under 35 U.S.C. § 101. The amendments to Claims 
15-28 are made to clarify that a computer-readable storage medium stores one or more 
sequences of instructions that may be executed by one or more processors of a machine. The 
amendments to Claims 15-28 are not made to disclaim any embodiments where instructions 
are transmitted or received over a transmission media prior to being stored on the computer- 
readable storage medium. 

REJECTIONS BASED ON THE CITED ART 
Claims 1-14, 29 and 30 were rejected under 35 U.S.C. § 102(b) as being allegedly 
anticipated by Sekiguchi (EP 0 999 490 A2) ("Sekiguchi"). This rejection is respectfully 
traversed. 
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Claims 15-28 stand rejected under 35 U.S.C. § 103(a) as being allegedly unpatentable 
over Sekiguchi in view of U.S. Patent No. 6,597,777 to Ho ("Ho"). This rejection is 
respectfully traversed. 

CLAIM 1 

Present Claim 1 recites: 

A method for monitoring a database, comprising: 

submitting a first set of one or more database queries, to a database server that 
manages the database, to retrieve, from the database server, user behavior 
data that indicates a first set of one or more actions performed, by one or more 
users, as a result of the one or more users executing a first set of database 
statements against the database; 

processing and storing one or more sets of user behavior data as historical data, said 
one or more sets of user behavior data including said user behavior data that 
was retrieved from the database server in response to the first set of one or 
more database queries being executed against the database; 

analyzing the historical data to determine behavior patterns; 

submitting a second set of one or more database queries, to the database server, 

to retrieve, from the database server, a new set of data that indicates a second 
set of one or more actions performed, by the one or more users, as a result of 
the one or more users executing a second set of database statements 
against the database; 
performing a comparison between the new set of data and the determined behavior 
patterns; 

determining, based on the comparison, whether the new set of data satisfies a set of 
criteria; 

if the new set of data satisfies the set of criteria, then determining that the new set of 

data represents anomalous activity; and 
responding to the determination by performing a targeted operation, (emphasis added) 

The Office Action cited paragraphs 21 and 22 of Sekiguchi as disclosing all the 
features of Claim 1. Applicants respectfully disagree. 

Sekiguchi lacks any discussion of detecting anomalous activity within a database. In 
fact, Sekiguchi fails to even mention the word "database." Instead, Sekiguchi is directed 
towards monitoring access to electronic equipment in general. Sekiguchi lacks any teaching 
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or suggestion of how the approach of Sekiguchi may be applied to a database. Consequently, 
numerous features in each pending claim are not taught or suggested by Sekiguchi. 

To illustrate, Claim 1 recites the feature of "submitting a first set of one or more 
database queries, to a database server that manages the database, to retrieve, from the 
database server, user behavior data that indicates a first set of one or more actions 
performed, by one or more users, as a result of the one or more users executing a first set of 
database statements against the database." The portion of Sekiguchi cited to show this 
feature (paragraph 21) lacks any suggestion of submitting a database query to a database 
server. Instead, the portion merely discusses an access monitor unit that acquires an access 
log using an access log acquisition unit. This portion is not analogous to submitting a 
database query to a database server that manages a database to retrieve, from the database 
server, user behavior data as claimed, i.e., user behavior that indicates actions performed by 
users as a result of the users executing database statements against the database. 

As Sekiguchi fails to teach or suggest submitting one or more database queries to a 
database server that manages a database, Sekiguchi cannot teach or suggest the feature of 
"processing and storing one or more sets of user behavior data as historical data, said one or 
more sets of user behavior data including said user behavior data that was retrieved from the 
database server in response to the first set of one or more database queries being 
executed against the database" as recited in Claim 1 . 

Claim 1 also recites the features of "submitting a second set of one or more 

database queries, to the database server, to retrieve, from the database server, a new set of 

data that indicates a second set of one or more actions performed, by the one or more users, 

as a result of the one or more users executing a second set of database statements against 
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the database." The portion of Sekiguchi cited to show this feature (paragraph 21) is the 
same portion cited to show the feature of submitting a first set of one or more database 
queries, i.e., that portion merely states that an access monitor unit acquires an access log 
using an access log acquisition unit. The cited portion of Sekiguchi lacks any teaching or 
suggestion of a database server, let alone submitting a database query, to the database server, 
to retrieve, from the database server, a set of data that indicates actions performed by users as 
a result of the users executing database statements against the database. 

Nothing in Sekiguchi suggests how the approach of Sekiguchi may be used or 
employed to detect anomalous activity within a database. Consequently, numerous features 
of Claim 1 are not taught or suggested by Sekiguchi. Therefore, it is respectfully submitted 
that Claim 1 is patentable over Sekiguchi. 

CLAIMS 15,29, AND 30 
Claims 15, 29, and 30 recite limitations similar to those discussed above with 
reference to Claim 1, except that they are recited in computer-readable storage medium 
format, means apparatus format, and non-means apparatus format, respectively. Thus, 
Claims 15, 29, and 30 recite the features of Claim 1 that make Claim 1 patentable over 
Sekiguchi. Therefore, for at least the reasons discussed above with respect to Claim 1, each 
of Claims 15, 29, 30 also are patentable over Sekiguchi. 

CLAIM 7 

The Office Action cited paragraphs 30 and 35 of Sekiguchi for disclosing the features 
of Claim 7. Specifically, the Office Action cites the first sentence of paragraph 35: 
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For this reason, the security management unit 1 12 manages information about a time 
zone using a method for determining the scope of the time zone where access is 
gained with a statistical process 

for disclosing "determining a probability function for frequencies of database access", and the 

second-to-last sentence of paragraph 35: 

Such statistical information about an access is calculated for all accesses without 
dividing a section or by dividing a section of, for example, the past one month or one 
year, if necessary, and the time zone in which an access is permitted is set based on 
the calculation 

for disclosing "determining a cumulative probability function from the probability function". 
Nothing in these cited portions of Sekiguchi refers to a probability function or a cumulative 
probability function. Even if Sekiguchi disclosed the feature of "determining a probability 
function for frequencies of database access," Sekiguchi fails to teach or suggest that a 
cumulative probability function is determined, must less a cumulative probability function 
that is determined from the probability function. 

REMAINING CLAIMS 
The remaining dependent claims depend (directly or indirectly) on Claim 1 or Claim 
15 discussed above. Each remaining dependent claim is therefore allowable for the reasons 
given above for Claim 1 . In addition, each remaining dependent claim introduces one or 
more additional limitations. However, due to the fundamental differences already identified, 
to expedite the positive resolution of this case a separate discussion of those limitations is not 
included at this time, although the Applicants reserve the right to further point out the 
differences between the cited art and the novel features recited in the dependent claims. 
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CONCLUSION 



For the reasons set forth above, it is respectfully submitted that all of the pending 
claims are now in condition for allowance. Therefore, the issuance of a formal Notice of 
Allowance is believed next in order, and that action is most earnestly solicited. 

The Examiner is respectfully requested to contact the undersigned by telephone if it is 
believed that such contact would further the examination of the present application. 

Please charge any shortages or credit any overages to Deposit Account No. 50-1302. 



Respectfully submitted, 



Hickman Palermo Truong & Becker LLP 



Dated: November 21, 2006 




Daniel D. Ledesma 



Reg. No. 57,181 



2055 Gateway Place, Suite 550 
San Jose, California 95110-1089 



Telephone No.: (408) 414-1229 
Facsimile No.: (408) 414-1076 
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